Hello Ken,
The main problem that I see with this is that a user could call to display a qmov, and then put in code so that $width closes the <object> and adds in a script. This is called an XSS exploit, and it should be pretty easy for you to patch.
I hope that this helps, Kasimir
On 2/26/07, Ken McDonald ken@pixologic.com wrote:
The following extension will allow embedding of QT videos in your wiki pages. (Well, it does for me.) Thanks to the author of the gflash extension; since I'm not actually a PHP programmer, this started out as his gflash extension, and much of the code and comments are unchanged from that extension.
Use; place in your extensions directory, in a file called 'qtmov.php'. Put include statement in LocalSettings.php (see comment at start of code.) Markup is of form:
<qtmov>320 240 mymove.mov</qtmov>First number is width of display area, second is height, movie will be scaled to fully fit within display area.
For me, this works with Firefox (OS X and Windows XP) and IE on XP.
Caveats:
- Not much testing. Don't know what happens if user doesn't have
appropriate qt plugin installed on system. (It's _supposed_ to show an appropriate message, according to description on markup I cut and pasted.)
- Security?
- Dunno what happens with media types that aren't understood. Security?
<?php # Copy into .../extensions/qtmov.php. # # To activate the extension, include it from your LocalSettings.php # with: include("extensions/qtmov.php"); # Use: # <qtmov>320 240 mymove.mov</qtmov> # First number is width of display area, second is height, movie will be scaled to fully fit within display area. # # Many thanks to author of 'gflash' extension (whose name I can't immediately find, sorry.) $wgExtensionFunctions[] = "wfQTMovExtension"; function wfQTMovExtension() { global $wgParser; # register the extension with the WikiText parser # the first parameter is the name of the new tag. # the second parameter is the callback function for processing the text between the tags $wgParser->setHook( "qtmov", "renderQTMov" ); } # The callback function for converting the input text to HTML output function renderQTMov( $input ) { $exploin = explode(" ",$input); $width = $exploin[0]; $height = $exploin[1]; $filename = $exploin[2]; $output = ('<object classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" width="' .$width. '"height="' .$height. '" codebase="http://www.apple.com/qtactivex/qtplugin.cab"><param name="src" value="' .$filename. '"><param name="autoplay" value="false"> <param name="controller" value="true"> <param name="scale" value="aspect"><embed src="' .$filename. '" autoplay="false" loop="false" controller="true" scale="aspect" width="' .$width. '"height="' .$height. '" pluginspage="http://www.apple.com/quicktime/"></embed>'); return $output; } ?>
MediaWiki-l mailing list MediaWiki-l@lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/mediawiki-l